Use SourceCraft with CodeGraph when repository coordinates are known and webhook-driven CPG and merge-request review processing is required. Unlike the other repository adapters, the current SourceCraft onboarding adapter deliberately uses fallback normalization instead of provider API discovery.
Supported contract
| Capability | Current support |
|---|---|
| Repository metadata lookup through provider API | No; explicit fallback normalization |
| Branch HEAD lookup during onboarding | No |
| Namespace repository listing or bulk discovery | No |
| Inbound push and merge-request webhook | Yes |
| Review comment publication | Yes through a generic review snapshot job |
The capability declaration is in
src/project_import/repository_suite/repository_provider_adapters.py. Explicitly provide the
repository name, clone URL, branch, or external ID when the defaults are insufficient.
Connect and import
python -m src.cli repos connect-provider --name sourcecraft-main --provider sourcecraft --base-url https://sourcecraft.yandex.cloud --host sourcecraft.yandex.cloud
python -m src.cli repos provider-health --connection sourcecraft-main
python -m src.cli repos import --connection sourcecraft-main --repo PROJECT/REPOSITORY --default-branch main
python -m src.cli repos status
The adapter works with an explicit SourceCraft namespace. For a
nonstandard clone address, add --clone-url; for a stable provider identifier, add
--external-id. Private access and review publication require a token supplied through the
customer’s protected secret channel.
Configure the webhook
Send push and merge-request events to:
POST /api/v1/webhooks/sourcecraft
Set SOURCECRAFT_WEBHOOK_SECRET in CodeGraph and configure X-SourceCraft-Signature at the
provider. When X-SourceCraft-Timestamp is present, CodeGraph validates its age against the
configured replay window. Keep the endpoint behind TLS and an ingress policy appropriate to the
pilot.
The receiver returns 202 Accepted for background intake. Accepted, deduplicated, and skipped
events are different outcomes; none proves review or CPG-update completion. Correlate the job ID
with repository status.
Review publication and status
Shared bindings and review snapshots are exposed below:
/api/v1/integrations/repositories
POST /api/v1/integrations/repositories/review-snapshots/{snapshot_id}/rerun
Set publish_review only when a comment should be posted to the target merge request. Publication
uses the connection token and stores its own status, reason, category, and error. Confirm those
fields after the job; publication status is recorded in published.
Authorized runtime operators can inspect:
GET /api/v1/admin/runtime/webhooks/status/{project_id}
Recovery and security
- If fallback coordinates are wrong, archive the binding and create a corrected explicit import; do not pretend provider discovery succeeded.
- Replay only the identified failed sync or review job.
- Keep provider tokens, webhook secrets, signatures, and timestamps out of logs.
- Keep TLS verification enabled. Use the connection’s
--ca-bundle-pathfor a private CA. - Treat merge-request content as untrusted before analysis or LLM processing.
Source of truth
- Provider adapter:
src/project_import/repository_suite/repository_provider_adapters.py - SourceCraft client:
src/api/services/repo_sync_services/sourcecraft_api.py - Review publication:
src/api/services/review_services/review_snapshot_publication.py - Current routes: REST API